(PVS) Signatures - Tenable Network Security

Mozilla Thunderbird 12.x < 12 Multiple Vulnerabilities
PVS ID: 6498 FAMILY: SMTP Clients RISK: HIGH NESSUS ID:59409
Description: Synopsis :\n\nThe remote host has a mail client installed that is vulnerable to multiple
vulnerabilities.\n\nFor your information, the observed version of Thunderbird is : \n %L
\n\nVersions of Thunderbird 12.x are potentially affected by the following security issues
:\n\n - An error exists in the ASN.1 decoder when handling zero length items that can lead
to application crashes. (CVE-2012-0441)\n\n - Multiple memory corruption errors exist.
(CVE-2012-1937, CVE-2012-1038)\n\n - Two heap-based buffer overflows and one
heap-based use-after-free error exist and are potentially exploitable. (CVE-2012-1940,
CVE-2012-1941, CVE-2012-1947)\n\n - Two arbitrary DLL load issues exist related to the
application update and update service functionality. (CVE-2012-1942,
CVE-2012-1943)\n\n - The inline-script blocking feature of the 'Content Security Policy'
(CSP) does not properly block inline event handlers. This error allows remote attackers to
more easily carry out cross-site scripting attacks. (CVE-2012-1944)\n\n - A use-after-free
error exists related to replacing or inserting a node into a web document.
(CVE-2012-1946)\n
Solution: Upgrade to Thunderbird 13.0 or later.
CVE-2012-1947
Roving Constant Contact E-mail Marketing Client Detection
PVS ID: 6499 FAMILY: SMTP Clients RISK: INFO NESSUS ID:Not Available
Description: The remote host is running the Roving Constant Contact E-mail client. Roving
Constant Contact is a software which includes the capability to launch e-mail
marketing campaigns.
Solution: Ensure that such software is authorized for your network
CVE Not available
iTunes < 10.6.3 Multiple Vulnerabilities
PVS ID: 6500 FAMILY: Web Clients RISK: HIGH NESSUS ID:59499
Description: Synopsis :\n\nThe remote host contains a multimedia application that has multiple
vulnerabilities.\n\nThe remote host has iTunes installed, a popular media player for
Windows and Mac OS. For your information, the observed version of iTunes is:\n %L
\n\nVersions of iTunes earlier than 10.6.3 are reportedly affected by the following
issues:\n\n - A memory corruption issue exists in WebKit that can allow malicious websites
to crash the application and possibly execute arbitrary code. (CVE-2012-0672)\n\n - A
heap-based buffer overflow exists related to the handling of 'm3u' playlist files. This error
can cause the application to crash or possibly allow arbitrary code execution.
(CVE-2012-0677)\n
Solution: Upgrade to iTunes 10.6.3 or later.
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1775